CMTFOI Patient Registry — Data Governance & Retention Policy

1. Purpose

To define how Registry information is governed across its life, from collection to deletion or anonymisation, so that Registry activity remains lawful, proportionate and trustworthy.

2. Scope

All Registry information, whether entered by participants, imported from existing CMTFOI records or generated by CMT Veda, and all systems, exports and processes used to handle it.

3. Data stewardship

• Registry administration: day-to-day operation, participant support and record management.
• Data protection: privacy contact, participant requests, consent governance and privacy assessments.
• Research governance: review of research and data-sharing requests.
• Technical security: access control, monitoring, backups and incident handling.
• Participant requests: intake, verification, action and response tracking.
• Audit: review of privileged actions, exports and consent events.
• Named role holders and reporting lines: As determined by the CMTFOI Board under its governance procedures.

4. Data quality

• Provenance: each Registry value records where it came from, including values carried from another CMT Veda profile area.
• Correction: participants can review and correct their information.
• Validation: questionnaire rules and value checks are applied at entry and at import.
• Duplicate management: existing CMTFOI records are matched and linked rather than duplicated.
• Auditability: changes to Registry records and privileged actions are recorded.

5. Access control

• Participants can access their own Registry information.
• Registry administrators access only what is needed to operate the Registry.
• Research access is granted only through the Data Sharing & Research Governance Policy.
• Access is role-based, least-privilege, individually attributable and reviewed periodically.

6. Data security

Organisational safeguards include role definitions, confidentiality expectations, onboarding and offboarding of access, and review of privileged activity.

Technical safeguards include authenticated access, row-level access rules, encryption in transit, separation of administrative functions, logging and backup.

7. Retention framework

Identifiable information in the CMTFOI Patient Registry will ordinarily be retained for up to 15 years from the participant's last meaningful interaction with or update to the Registry, unless a different period is required or permitted by applicable law, an approved research or governance requirement, or another documented legitimate purpose.

15 years is CMTFOI's default retention period for inactive identifiable Registry data, subject to applicable law, documented governance requirements and periodic review. It is a CMTFOI policy choice informed by international health-data governance practice; it is not a global standard and not a legally mandated period.

The framework reflects the principle that personal health data should not be kept longer than necessary, while recognising that appropriately governed health databases may need long-term retention for legitimate research purposes.

7.1 Last meaningful interaction or update

A last meaningful interaction or update is a documented participant interaction or material update relevant to continued Registry participation, rather than a login or an automated system event. The retention clock runs from the most recent such event.

• Counts: updating Registry information.
• Counts: completing or updating a Registry assessment.
• Counts: confirming or updating clinical information.
• Counts: submitting a meaningful Registry update.
• Counts: explicitly confirming continued Registry participation.
• Does not count: background system processing, automated emails, security logs, analytics, automatic backups.

7.2 Retention table

• Identifiable active Registry data → retain while legitimately required and the participant remains active, subject to continuing consent or another lawful basis, the Registry's stated purposes, applicable law and periodic governance review. No automatic 15-year deletion event is created for active participants.
• Identifiable inactive Registry data → retention review at 15 years from the last meaningful interaction or update. The review, not the date, decides the outcome.
• Withdrawn identifiable Registry data → delete or irreversibly anonymise within a reasonable period, subject to lawful and documented governance exceptions. Withdrawal does not wait for the 15-year period.
• Pseudonymised or otherwise re-identifiable research data → retain according to the approved research purpose, applicable consent or law, the research governance approval, the applicable data-sharing agreement and a documented retention and review period. The general Registry period is not applied automatically.
• Irreversibly anonymised research data → potentially long-term or indefinite retention while legitimate scientific, statistical, public-health, educational or historical value continues, subject to periodic governance review.
• Consent and audit records → the minimum information necessary is retained for legitimate accountability, audit, legal and governance purposes.
• Backups → handled under the documented backup lifecycle; no retention duration is asserted here.

7.3 Retention review for inactive participants

• Reaching the review point triggers a review, never immediate automatic deletion.
• The review determines whether continued identifiable retention remains necessary, whether the information should be securely deleted, whether it can and should be irreversibly anonymised, or whether another documented legal or governance basis justifies continued retention.
• Where continued retention is approved, the reason and the next review date are recorded.

7.4 Pseudonymised and anonymised data

• Data that has been de-identified or pseudonymised but can still reasonably be linked to an individual remains subject to appropriate personal-data safeguards.
• Such data is not treated as anonymous merely because direct identifiers have been removed; 'de-identified' is not a synonym for 'irreversibly anonymised'.
• Research datasets that have been irreversibly anonymised so that individuals are no longer reasonably identifiable may be retained for as long as they continue to have legitimate scientific, statistical, public-health, educational or historical research value, subject to periodic governance review.
• Continuing scientific or public-interest value is reviewed periodically, datasets are securely destroyed when there is no longer a legitimate continuing purpose, and the anonymisation process is appropriately documented.

7.5 Retention review governance roles

Retention review is a governance decision, not a technical one. The following functional roles apply; no individual is named in this Policy.

• Registry Data Steward — the designated role is Head, Registry & Data Governance. The role coordinates, conducts and documents retention reviews, assesses whether continued identifiable retention is justified, records the recommended outcome, and initiates escalation where CMTFOI Board approval is required. No individual is named in this Policy.
• CMTFOI Board — the final approval authority for retention decisions and governance exceptions. The Head, Registry & Data Governance conducts and documents the review; the Board approves or declines where approval is required, and oversees compliance with the Registry governance framework. No individual Board member is named.
• System / Registry Administrator — carries out an approved deletion or anonymisation action and records its completion. This is a technical role only: it does not determine whether participant information is retained, anonymised or deleted, and it cannot override a retention decision.

7.6 Retention review record

Every completed retention review is documented as a governance record. The record uses the Patient ID or another controlled internal Registry reference; name, contact details, address and clinical content are not duplicated into the governance record.

• Internal review record identifier.
• Patient ID or appropriate internal Registry reference.
• Review date.
• Date of the last meaningful interaction or update.
• Retention-review due date.
• Current data status at the time of review.
• Review outcome, from the controlled list below.
• Reason or justification for the outcome.
• Legal or governance basis, where applicable.
• Reviewing role (Head, Registry & Data Governance).
• CMTFOI Board approval status, where approval is required, and the approval date.
• Next review date, where continued identifiable retention is approved.
• Action completion date, where deletion or anonymisation is carried out.
• Link to the previous decision, where a decision has been revisited.

7.7 Controlled review outcomes

A review must conclude with exactly one of the following controlled outcomes. A free-text justification accompanies the outcome but does not replace it. Approval authority is fixed: RETAIN and ANONYMISE may be approved by the Head, Registry & Data Governance; RETAIN — GOVERNANCE EXCEPTION and DELETE require CMTFOI Board approval; an escalated review remains pending until resolved by the appropriate governance authority, with the CMTFOI Board as the final escalation authority.

• RETAIN — continued identifiable retention remains necessary; may be approved by the Head, Registry & Data Governance. The reviewer documents why: continuing active Registry participation, an ongoing legitimate Registry purpose, a documented research or governance requirement, a legal or regulatory requirement, or another documented legitimate purpose. Where retention is approved after the normal review point, a next review date is recorded.
• RETAIN — GOVERNANCE EXCEPTION — continued identifiable retention departs from the normal retention approach; requires CMTFOI Board approval. It requires a documented reason, an identified approving governance role, an approval date and a next review date. Indefinite exceptions without periodic review are not permitted.
• ANONYMISE — may be approved by the Head, Registry & Data Governance. The information is put through the approved anonymisation process and completion is recorded. The resulting dataset is not described as anonymous merely because direct identifiers were removed; the anonymisation methodology is documented separately where appropriate. Once information is irreversibly anonymised it may fall outside personal-data retention requirements, subject to the applicable legal framework.
• DELETE — requires CMTFOI Board approval. The existing deletion process is used, completion is recorded, and the participant's historical Patient ID is never recycled or altered. Only the minimum governance and audit information legitimately required to demonstrate the action is retained; consent and withdrawal evidence is not deleted where it is legitimately required for accountability.
• ESCALATE / PENDING DECISION — the reviewer cannot determine the appropriate outcome. The reason for escalation, the responsible governance role, the date escalated and the eventual decision are recorded, with the CMTFOI Board as the final escalation authority. Information is neither silently retained as settled nor deleted while the decision is pending; the review stays open until resolved.

7.8 Auditability of retention decisions

• Retention-review records are append-only. Historical retention decisions are never overwritten or edited in place.
• Where a decision is later changed, the original decision is preserved and a new review event is created recording who made the change, when, and why.
• Retention-review records are held separately from consent records. A consent record establishes which document and version was accepted, when, by whom and through which pathway; a retention-review record establishes why identifiable information was retained, anonymised or deleted, by which governance role, when and on what documented basis. The two are not merged, and historical consent events are never modified by a retention review.

7.9 No automatic destruction

• The 15-year point is a governance review trigger. It does not automatically delete, anonymise or classify anyone.
• No participant is classified as inactive solely because time has elapsed; inactivity is judged at governance review against the definition of a last meaningful interaction or update.
• The automated internal reminder never deletes or anonymises information, never modifies Registry information, consent, Patient ID or participant status, and never makes a legal or governance determination. It only creates or surfaces a review task.
• The retention-review workflow is internal. It is not exposed in the participant-facing Registry, which continues to offer consent, Registry Settings, withdrawal, privacy information and access or correction mechanisms as applicable.

7.10 Official system of record

The official system of record for retention-review decisions is the CMTFOI Patient Registry's secure administrative and governance database. No spreadsheet or external repository is used as the authoritative record.

• Access is restricted to authorised governance personnel through the Registry's existing authentication, role and row-level access controls.
• Each record references the Patient ID or another controlled internal Registry reference rather than duplicating name, contact details, address or clinical content.
• The record is append-only and auditable: historical decisions are preserved and cannot be edited or removed, and a revisited decision is stored as a new governance event linked to the previous one.
• Recording a decision is itself written to the Registry's privileged-action audit trail, with controlled values only.

7.11 Internal governance reminder

An automated internal reminder is generated 90 days before an identifiable Registry record reaches its retention-review date, creating or surfacing a review task for the Head, Registry & Data Governance.

• The reminder may carry the Patient ID or internal Registry reference, the retention-review due date, the days remaining and a link to the authorised governance review interface.
• Reminders are internal. They are shown only within the restricted governance area and are never shown to Registry participants.
• The reminder is delivered in the restricted governance interface only. Email and other external notification channels are deliberately deferred and will be considered later as part of CMTFOI's wider notification framework.
• The reminder is a notification mechanism, not the source of truth: the underlying review remains visible in the authorised governance interface until it is completed.

7.12 CMTFOI Board approval

• Where Board approval is required, the review is marked 'Pending CMTFOI Board Approval' and remains open until the Board decision is recorded.
• The reviewer, the recommendation, the review date, the justification, the Board approval status, the approval date and the final outcome are all preserved.
• A technical administrator cannot bypass a required Board approval, and no deletion or anonymisation is carried out before that approval is recorded.

7.13 Items requiring CMTFOI approval

The schedule on which the CMTFOI Board considers escalated retention decisions remains to be confirmed: As determined by the CMTFOI Board under its governance procedures. External notification channels for the internal reminder are deferred by decision and are not pending here.

8. Deletion and anonymisation

• Participant withdrawal triggers the applicable deletion or anonymisation workflow: the withdrawal event is recorded, consent-dependent processing stops subject to applicable law, the participant's identifiable Registry data is identified, and it is deleted or irreversibly anonymised within a reasonable period.
• Deletion removes identifiable Registry content held for consent-based purposes.
• Anonymisation removes identifiers so that the information can no longer reasonably be linked to a participant.
• Irreversible anonymisation cannot be undone, and such information may not be removable from analyses already carried out.
• Only the minimum information necessary to demonstrate the withdrawal, maintain security, satisfy legal obligations or meet legitimate audit requirements is preserved.
• Consent records are not deleted merely because a participant's Registry data is deleted; unnecessary clinical or Registry information is not kept merely to preserve proof of consent.

8.1 Backups

Deleted Registry information may remain temporarily in secure backup systems until those backups expire or are securely overwritten in accordance with the applicable backup lifecycle. Backup copies must not be used to restore withdrawn information into active Registry processing except where necessary for disaster recovery, security, legal or operational purposes.

The documented backup lifecycle and its durations require CMTFOI approval: As determined by the CMTFOI Board under its governance procedures.

9. Consent governance

• Every consent event records the document number, version, language, timestamp, participant type and how consent was given.
• Consent events are added, never overwritten; historical consent is preserved.
• Withdrawal is recorded as an event against the consent record, with the time of withdrawal.
• Re-consent is recorded as a new event, including when a participant who previously had guardian consent becomes eligible to consent for themselves.
• Adult self-consent and parent or legal guardian consent are distinguishable in the record.

10. Incident and breach management

Suspected incidents are reported internally without delay, contained, assessed for risk to participants, and recorded.

Where notification to a regulator or to affected participants is required by applicable law, CMTFOI makes that notification within the applicable timeframe.

11. Governance review

This Policy is reviewed at least annually, and earlier where required by law, technology, governance requirements or material changes to the Registry. Each issue carries a document number, version and effective date. Approval authority: CMTFOI Board. Next scheduled review: September 2027.